Senior Offensive Security Engineer – Web & API Pen Tester (Contract)

Applaudo; Región Metropolitana de Santiago; Hybrid; CLP 81,515,000 - 149,444,000; Part time

Job summary

Applaudo is seeking an experienced offensive security professional to conduct production-grade penetration testing of web apps, REST/SOAP APIs, and SSO-protected platforms. The contractor role runs for an initial two-month period with a potential extension, emphasizing safe testing in production, clear evidence, and regulatory-ready reporting.

The expert will perform both outside and inside testing, document CVSS-based findings, and deliver attestation letters and weekly English reports to a

Qualifications

• 5+ years hands-on pentesting, including 3+ years on web apps and APIs in production.
• Manual testing aligned to OWASP WSTG and OWASP Top 10.
• API security testing per OWASP API Security Top 10 (BOLA/IDOR).
• SSO protected apps testing (OAuth 2.0, OIDC, SAML) including Entra ID.
• Burp Suite Pro with extensions and custom payloads.

Responsibilities

• Perform outside unauthenticated testing of in-scope web apps, REST and SOAP APIs, an API gateway and internet-exposed hosts.
• Perform inside testing from client-provided accounts, covering cross-role and cross-account authorization, privilege escalation and access beyond the assigned role.
• Discover API specifications such as OpenAPI, WSDL and Postman collections for REST and SOAP services before testing when required.
• Base every finding on an exploitation attempt and record its result, listing scan-only items separately as untested.
• Test all authorized in-scope assets, or document the reason for exclusion when client-side dependencies are not met.
• Execute all testing without causing service disruption or data loss, escalating stop conditions within one hour.
• Score findings using CVSS v3.1 and document reproducible evidence suitable for regulatory review.
• Contribute to the draft report, the final report and the signed attestation letter covering the outside, inside application and inside identity perspectives.
• Support the revalidation report delivered within 60 days of the final report.
• Report weekly status in English and participate in working sessions with the client security team.

Skills

Penetration testing

Web apps testing

API testing

OWASP WSTG

Burp Suite

SSO testing

Regulatory reporting

Education

Bachelor's degree in CS/ cybersecurity

Tools

SoapUI

Amass

subfinder

httpx

Nmap

Burp Suite Pro

Job description

Applaudo is seeking an experienced offensive security professional to conduct production-grade penetration testing of web apps, REST/SOAP APIs, and SSO-protected platforms. The contractor role runs for an initial two-month period with a potential extension, emphasizing safe testing in production, clear evidence, and regulatory-ready reporting.

The expert will perform both outside and inside testing, document CVSS-based findings, and deliver attestation letters and weekly English reports to a